agent-sdlc
A software development lifecycle shipped as agent config for Claude Code and Codex: rules, skills, slash commands, hooks, and a diff-scoped mutation gate.
Docs: https://pavelguzenfeld.com/agent-sdlc/
Why
A coding agent writes the code and the tests for it, and tests written next to the code tend to agree with it, bugs included. On a mature suite, 57% of real bug-class mutants survived. agent-sdlc puts that check, plus scope, intent and git safety, into hooks and a gate instead of leaving them to the agent's memory.
| Problem | What catches it |
|---|---|
| Tests that pass but assert nothing | mutation-gate: a surviving mutant blocks the commit |
| Tests shaped to the code | An adversary review that sees intent and tests, never the code |
| Scope creep | 40-line limit without a ticket; one ticket, one branch, one PR |
| Design notes rotting in the tree | New .md files are blocked; intent lives in the tracker |
| Destructive git | A hook that denies reset --hard, add -A, force-push |
| AI tells and leaked identity in commits | commit-msg and no-leaks hooks |
Example
def is_adult(age):
return age >= 18
def test_adult():
assert is_adult(30)
def test_child():
assert not is_adult(5)
BLOCKED: 2 mutant(s) survived with no waiver.
age.py:2:11:operator:age >= 18 => age > 18
age.py:2:18:literal:18 => 19
Add assert is_adult(18) and assert not is_adult(17), and the gate passes.
Install
git clone https://github.com/PavelGuzenfeld/agent-sdlc
cd agent-sdlc
./install.sh --target all --deps
| Want | Do |
|---|---|
| The whole pack | ./install.sh --target all --deps (targets: claude, codex, all; --deps=say adds voice) |
| Only the gate | pip install agent-sdlc (WordNet check: agent-sdlc[vocabulary]) |
| A plugin | claude --plugin-dir /path/to/agent-sdlc, or add the repo as a Codex marketplace source |
| The gate on a repo | Add .mutation-gate.toml, wire the pre-commit hooks |
install.shlinksskills/into~/.claudeand~/.codex, linkscommands/andbin/into~/.claude, renderscommands/as Codex skills and merges the hooks. A second run changes nothing.ast-grep-cliadds ansgshim that can shadow the systemsg; callast-grep.
Use it
In Claude Code (Codex: $name instead of /name):
./install.sh --target claude --deps- In your repo:
touch .mutation-gate.toml && mutation-gate rules sync claude, then/grill <idea>orgh issue create …- Approve the ticket:
gh issue edit 42 --add-label model:sonnet /kata 42: a worker writes the failing test, implements, gates, opens the PR- Review, then type
LGTM: it squash-merges and cleans up /doneto close out the session
Full walkthrough, and what differs in Codex: https://pavelguzenfeld.com/agent-sdlc/usage/
What's inside
| Path | What |
|---|---|
rules/ |
How to work; synced into a repo with mutation-gate rules sync |
commands/ |
Slash commands: /kata, /done, /grill, /rectify … |
skills/ |
On-demand playbooks: /diagnose, /sol-budget, /verify-generated-diff … |
bin/ |
Hooks and helpers: git-guardrail.sh, the /say stack |
mutation_gate/ |
The gate and the mutation-gate CLI |
CI runs scripts/no-leaks.sh on every PR. It flags emails, RFC1918
addresses, user-at-host references, /home/<user>/ paths and non-personal
ghcr.io/ paths, and prints only file:line.
MIT, see LICENSE and NOTICE.md for one vendored third-party skill. Contributions: CONTRIBUTING.md, bound by CODE_OF_CONDUCT.md. Security: SECURITY.md.
Release files for agent-sdlc 0.2.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| agent_sdlc-0.2.1.tar.gz | 76.8 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| agent_sdlc-0.2.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 168.3 kB
Release files / agent_sdlc-0.2.1.tar.gz
| Download URL | agent_sdlc-0.2.1.tar.gz |
|---|---|
| Size | 76.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
c55537b2ab4f6c201f7782f5ef8fff184baea1aba6f2025c3f5d14284e1ea21d
|
|
BLAKE2b-256 checksum How to use checksums |
8f98477325def1725d80cd432a763947ab0a5cb3a83d4819ac927847de6d4ec0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 25, 2026.
Transparency logRelease files / agent_sdlc-0.2.1-py3-none-any.whl
| Download URL | agent_sdlc-0.2.1-py3-none-any.whl |
|---|---|
| Size | 91.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ed25b0316a067c61fc6b2177ed4880cc66c25a7a1c26f95a4d2f93e37907c826
|
|
BLAKE2b-256 checksum How to use checksums |
7a0321cb02dc970b5b4afe351c94e679eed341a8cdf1e5976a723a3fa51ca472
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 25, 2026.
Transparency log